Proxy: change default offset to take final IP

[michael-smt]

Relates to #9854

Proposed changes

The X-Forwarded-For header is appended to by every proxy between the client and Weblate. The header is split by , in weblate/middleware.py, then the value at the index set by IP_PROXY_OFFSET is passed to Django validators.

Change the default to -1 to take the last entry in the list of addresses. This is the proxy closest to Weblate. Which is assumed to be the most trusted when IP_BEHIND_REVERSE_PROXY is enabled.

Checklist

• Lint and unit tests pass locally with my changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added documentation to describe my feature.
• I have squashed my commits into logic units.
• I have described the changes in the commit messages.

Other information

The MDN web docs also recommends using the final value(s):

If any trusted reverse proxies are between the client and server, the final X-Forwarded-For IP addresses (one for each trusted proxy) are trustworthy, as they were added by trusted proxies.
[...]
Conversely, leftmost (untrusted) values must only be used where there will be no negative impact from the possibility of using spoofed values.

[nijel]

Can you please document the change as it is possibly breaking one? In docs/changes.rst and in docs/admin/config.rst.

[codecov]

Codecov Report

Merging #9859 (b4ec760) into main (d23693c) will increase coverage by 0.00%.
Report is 16 commits behind head on main.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##             main    #9859   +/-   ##
=======================================
  Coverage   90.74%   90.74%           
=======================================
  Files         787      787           
  Lines       57005    57015   +10     
  Branches     8872     8874    +2     
=======================================
+ Hits        51729    51739   +10     
  Misses       3715     3715           
  Partials     1561     1561           

Files Changed	Coverage
weblate/trans/models/_conf.py	100.00%
weblate/utils/tests/test_middleware.py	100.00%

[nijel]

Merged, thanks for your contribution!